SiYuan versions >= 2.1.12 and < 3.7.0 contain a stored cross-site scripting vulnerability in the Bazaar marketplace feature. The vulnerability is caused by improper neutralization of input when rendering package author metadata from the public bazaar stage feed into HTML without escaping. Because the SiYuan desktop app uses Electron with nodeIntegration enabled and contextIsolation disabled, an attacker can inject malicious scripts that execute Node.js APIs, leading to remote code execution on the host machine. The vulnerability is tracked as CWE-79 (Improper Neutralization of Input During Web Page Generation) and CWE-94 (Improper Control of Generation of Code). The issue is resolved in SiYuan version 3.7.0.

Successful exploitation results in stored XSS that allows an attacker to execute arbitrary code on the host system via Node.js APIs due to Electron's insecure configuration. This can lead to full compromise of the affected host running the vulnerable SiYuan desktop application. The CVSS v3.1 base score is 8.3 (high), reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

This vulnerability is fixed in SiYuan version 3.7.0. Users should upgrade to version 3.7.0 or later to remediate this issue. Since the product is not a cloud service, remediation requires applying the official update. Patch status is confirmed fixed in version 3.7.0. No other mitigations are indicated by the vendor advisory.